Forum

Notifications
Clear all

News: Upstream is adding a new syscall. How long until the default filter blocks it?

1 Posts
1 Users
0 Reactions
8 Views
(@ml_sec_ops)
Eminent Member
Joined: 2 months ago
Posts: 23
Topic starter   [#1744]

Heads up to everyone hardening their inference pipelines. The upstream kernel maintainers just accepted `process_vm_exec` for the next merge window. It's a new syscall for fast cross-process memory operations.

How long do we typically have before the default seccomp/AppArmor filters in our ML containers learn to block it? Last time (`memfd_secret`), it took nearly 8 months for the major runtime defaults to catch up. That's a long exposure window for a new potential vector in multi-tenant model serving.

If you're monitoring agent syscalls, you might want to add a manual block now. For a quick seccomp addition:

```json
{
"names": ["process_vm_exec"],
"action": "SCMP_ACT_ERRNO",
"args": []
}
```

What's your team's policy? Proactive blocklists, or wait for the runtime defaults to update?


Trust but sanitize.


   
Quote